Otherwise, I suspect that there is another system or device on your LAN that uses SIP over UDP to communicate with a remote service (bypassing FreePBX). So when that device makes a request from port 5060 (ahead of FreePBX), your firewall is then forced to assign a different port to FreePBX, because 5060 is already taken. Your firewall may have some settings that will effectively reserve port 5060 for Asterisk. Or, you may be able to change the local SIP port on the competing device to something other than 5060.